This objective confirms that the physical access controls identified and documented in PE.L2-3.10.1[a–b] are actually in place and functioning across your organization. It verifies that systems storing Controlled Unclassified Information (CUI) are physically protected as described in your policies and plans.